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Abstract 

A cryptographic hash function is a deterministic procedure that com- 
presses an arbitrary block of numerical data and returns a fixed-size bit 
string. There exists many hash functions: MD5, HAVAL, SHA, ... It 
was reported that these hash functions are no longer secure. Our work 
is focused on the construction of a new hash function based on composi- 
tion of functions. The construction used the NP-completeness of Three- 
dimensional contingency tables and the relaxation of the constraint that 
a hash function should also be a compression function. 

Keywords : NP-complete, One-way function, Matrix of zeros and ones, 
Three-dimensional contingency table, Collision-resistant hash function. 

1 Introduction 

A cryptographic hash function is a deterministic procedure that compresses an 
arbitrary block of data and returns fixed-size bit string, the hash value (message 
digest or digest). An accidental or intentional change of the data will almost 
certainly change the hash value. Hash functions are used to verify the integrity 
of data or data signature. 

Let us suppose that h : X — > Y is a hash function without key. The function h 
is secured if the following three problems are difficult to solve. 

Problem 1: First Preimage attack 

Instance: a function h : X — > Y and an image y G Y 
Query: x £ X such that h(x) = y 

We suppose that a possible hash y is given, we want to know if there exists x 
such that h(x) = y. If we can solve First Preimage attack, then (x,y) is a valid 
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pair. A hash function for which First Preimage attack can't be solved efficiently 
is sometimes called Preimage resistant. 

Problem 2: Second Preimage attack 

Instance: a function h : X — > Y and an element x\ G X 
Query: X2 £ X such that x\ ^ X2 and h(x\) = h(x2) 

A message X\ is given, we want to find a message X2 such that X2 ^ x\ and 
h{x\) = h(x2)- If this is possible, then (X2, h(x{)) is a valid pair. A function 
for which Second preimage attack can't be solve efficiently is sometimes called 
Second preimage resistant. 

Problem 3: Collision attack 

Instance: a function h : X — > Y 

Query: xi,X2 € X such that x\ ^ X2 and h(x±) = h(x2) 
We want to known if it is possible to find two distinct messages x\ and X2 such 
that h(xi) = h{x2). A function for which Collision attack can't be solve effi- 
ciently is sometimes called Collision resistant. 

There exists many hash functions: MD4, MD5, SHA-0, SHA-1, RIPEMD, 
HAVAL. It was reported that such widely hash functions are no longer secured 
[i [TO! HI HI HI HU- Thus, new hash functions should be studied. The 
existing hash functions such as MD4, MD5, SHA-0, SHA-I, RIPEMD, HAVAL... 
want to achieve two goals at the same time: 

a ) For any input a;, they return a hash of x (of fixed length, this length depends 
on the hash function choosed) 

b°) Preimage resistant, Second Preimage resistant and Collision Resistant. 

Our contribution is to separate the two goals defined in points a ) and 6°). 
Our hash function H3 is defined as follows: 

• H 3 = H 2 oH u 

• H 2 is a classical hash function such as MD5, SHA-0, SHA-1, RIPEMD, 
HAVAL, .... 

• Given a y, find x such that Hi(x) = y is NP-Complete, 

• Find Xi, X2 such that x\ 7^ X2 and H\(x\) = H\{x2) is NP-Complete, 

• For any input x, the length of H\(x) is not fixed. This is the main differ- 
ence with the classical hash functions. 

The paper is organized as follows: in Section 2, some preliminaries are pre- 
sented. Section 3 is devoted to the design of our hash function. Concluding 
remarks are stated in Section 4. 
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2 Preliminaries 

Let's define some preliminaries useful for the next section. 
2.1 Two-dimensional 

Data security in two dimension have been studied by many authors [21 El [U [17] . 
Let m and n be two positive integers, and let R = (n, r2, . . . , r m ) and S — 
(si, S2, ■ ■ • , s n ) be non-negative integral vectors. Denoted by 2l(i?, S 1 ) the set of 
all 77i x n matrices A = (a>ij) satisfying 

a,ij = or 1 for i = 1, 2, . . . , m and j = 1, 2, . . . , 77; 
Qjj = n for i = 1,2, . . . ,777; 

m 

^ ffljj = s 3 - for j = 1,2,..., 77. 

i=l 

Thus a matrix of O's and l's belongs to 5) provided its row sum vector is 
R and its column sum vector is S. The set 2l(i?, S) was studied by many authors 
[2 HI [6J [16] . Ryser [16] has defined an interchange to be a transformation 
which replaces the 2x2 submatrix : 

Bo = ( 1 

of a matrix A of O's and l's with the 2x2 submatrix 

If the submatrix Bq (or B{) lies in rows k, I and columns u, v, then we call the 
interchange a (k, I] u, v) -interchange. An interchange (or any finite sequence of 
interchanges) does not alter the row and column sum vectors of a matrix. Ryser 
has shown the following result. 

Theorem 1 Let A and A* be two m and n matrices composed of O's and 
1 's, possessing equal row sum vectors and equal column sum vectors. Then A is 
transformable into A* by a finite number of interchanges. 

Let us consider a matrix A G {0, l} nx ™ g 2l(i?, S), i.e. its row sum vector 
R is such that R € {0, 1, 2, ... , n} n and its column sum vector S is such that 
S G {0, 1, 2, ... , 77}". We define the function g x from {0, l} nxn to N 2n as follows: 

91 (A) =R(l)\\R(2)\\... \\R(n)\\ 
S(l)\\S(2)\\...\\S(n) 

where II denotes the concatenation. 
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2.2 Three-dimensional 

Irving and Jerrum [15] have studied the extension of the problem in three di- 
mension and shown that problems that are solvable in polynomial time in the 
two-dimensional case become NP-Complete. Suppose that for a given n x n x n 
table D of non-negative integers, and for each i,j,k, the row, column and file 
sums are denoted by R(i, k), C(j, k) and F(i,j) respectively. In other words: 

n 

R(i,k) = J2D(i,j,k) 

3=1 
n 

C(j,k) = J2 D (hj^) 

2=1 

n 

F(i,j) = J2D(i,j,k) 

k=l 

The following problem is studied by Irving and Jerrum |15j : 

Problem 4. Three-dimensional contingency tables (3DCT) 

Instance: A positive integer n, and for each k non-negative integers 

values R(i,k), C(j,k) and F(i,j) 
Question: Does there exist an n x n x n contingency table X of non- 
negative integers such that: 

n 

J2x(i,J,k) = R(i,k) 

3 = 1 
n 

Y,X(i,j,k) = C(j,k) 

i=l 
n 

fc=i 

for all k ? Irving and Jerrum show the following result: 

Corollary 1 J15]j 3DCT is NP- Complete, even in the special case where all the 
row, column and file sums are or 1. 

Let us consider a matrix A G N nxnx " such that its row sum matrix is a 
matrix R such that R G Jf lXTl (i.e. R(i, k) £ N) , the column sum matrix is a 
matrix C such that C G pf ix ™ (i.e. C(j, k) G N) and the file sum matrix is a 
matrix F such that F G N™ xn (i.e. F(i,j) G N). We define the function g 2 as 
follows: 

g 2 (A) =i?(l, l)||fl(l, 2)||...||i2(»,n)|| 
C(l,l)||C(l,2)||...||C(n,n)|| 
F(l,l)||F(l,2)||...||F(n,n) 
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Let us consider the following matrices A and B. We define the element 
product of matrices A and B as follows: 

Definition 1 Element Product of Matrices of dimension 2 

Let A, B E R™ lX ™ 2 7 we define the Element product of matrices A and B as 

follows: 

C = A . * B ; where Cjj = <Zy x fry for i,j such that 



Definition 2 Element Product of Matrices of dimension 3 

Let A,B 6 l™ lXn2X " 3 , we define the Element product of matrices A and B as 

follows: 

C — A . * B ; where Cijk = x bijk for i,j,k such that 



3 Design of the hash function 

Before the construction of our hash function, let us explain the main idea. 

3.1 Explanation of the idea by an example 

In page 175 of paper [I], Brualdi gives the example of the following five matrices: 



which belong to 2l(i?, S) where R = S = (2, 2, 1). Let us note W the following 
matrix: 



Based on the Element Product of Matrix defined in the previous subsection, it 
is easy to verify that: 



1 < i < m and "\.<j<n% 



1 < i < ni , 1 < j ' < ri2 and 1 < k < 






( 1 4 \ / 1 4 \ / 1 4 \ 

Ai .* W = 2 8 ; A 2 .* W = 2 18 ; A a .* W = 8 18 

\ 27 / \ 12 J \ 3 / 
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/ 4 9 
A 4 • * W = 2 8 
\ 3 



) 



/ 1 9 
A 5 . * W = 2 8 
\ 12 



) 



By computation, we evaluate that: 

ffi (Ai.* W) = 5||10||27||3||12||27 ffi(A 2 . * VK) = 5||20||12||3||16||18 
31 (A 3 .* W) = 5||26||3||4||12||18 ffi(A 4 . * W) = 13||10||3||5||12||9 
gi(A 5 .* W) = 10||10||12||3||20||9 

It is easy to verify that A 1 (2, 2) ^ A 2 (2,2), A (2, 3) ^ A 2 (2,3) , A 1 (3, 2) ^ 
A 2 (3, 2) and A (3, 3) ^ A 2 (3, 3). All these differences imply that 

• the second term of gi(A\ . * W) is not equal to the second term of 
gi(A 2 . * W), 

• the third term of gi (A\ . * W) is not equal to the third term of g\ ( A 2 .* W) , 

• the fifth term of g\ {A\ . * W) is not equal to the fifth term of g\ (A 2 .* W), 

• the sixth term of g\ (A\ . * W) is not equal to the sixth term of g\ (A 2 .* W) . 

More formally, from the construction of gi, we can deduce easily that if 
A(i,j) ^ B(i,j), then : 

c°) the i-th term of gi(A .* W) would probably be different from the i-th term 
of gi(B . * W), 

d°) the (n+j)-th term of gi(A . * W) would probably be different from the 
(n+j)-th term of g x (B .* W). 

From the fact that 3DCT which is related to g 2 (this is an extension of g\) 
is NP- Complete, we deduce that: 

e°) Given y and a matrix W, find a matrix A such that g 2 (A . * W) — y is 
NP-Complete. 

Our idea is to build a new hash function H 3 such that #3 = H 2 oH\ where 

• H 2 is a classical hash function such as MD5, SHA-0, SHA-1, RIPEMD, 
HAVAL,... 

• H\ is a function which exploits the ideas presented in c°) , d°) and e°). 

Let us denote VOnes(n) the vector such that VOnes(n) e {0, 1}" and each 
of its elements is equal to 1. Also, let us denote MOnes(n) the matrix such 
that MOnes{n) G {0, 1}™*™ and each of its elements is equal to 1. in other 
words: 



VOnes(n)i — 1 where 1 < i < n 
Mones(n)ij — 1 where 1 < i,j < n 
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We denote N + the set of strictly positive natural number denned as follows: 

JV+=N\{0} = {1,2,3,4,...} 

In the next sub-section, we formalize the observation made in points c°) and 
d°) and we take into account the NP-Completeness of 3DCT to build a new 
hash function. 



3.2 Construction of the new hash function 

For any integers a and p such that < a < — 1 + 2 P , let us denote bin(a,p) the 
decomposition of the integer a in base 2 on p positions. In other words: 

p-i 

bin(a, p) = x p -\x p - 2 ■ ■ ■ xix and x; t x 2 l = a 

i=0 

Let us also define the following function: 

/ (n) = \log 2 (n+ 1)] 

/o(n) represents the number of bits necessary to represent any integer between 
and n in base 2. 



We also define the following functions: 

{n n 
^2^2A(i,j,k) : l<i<n 
j=i k=i 

{n n 
i=l k=l 

{n n 
i=i j=i 

f 4 (A)=max{f 1 (A),f 2 (A),f 3 (A)}. 

fi{A) represents the maximun of sum of any n consecutive elements of the ma- 
trix A belonging to the same row, or to the same column or to the same file. 
foofi{A) represents the number of bits necessary to represent in base 2 the sum 
of any n consecutive elements of the matrix A belonging to the same row, or to 
the same column, or to the same file. 

Subsequently, in the aim to be more precise, we redefine g 2 as follows: 



g 2 (A) ^n(i?(l,l),/ o0 / 4 (A))||M^(l,2),/oo/4(A))||...||^n(i?(n,n),/oo/4(A))|| 

MC(l,l),/oo/4(^))||M^(1.2),/oo/4(A))||...||M^(n»»)./oo/4(^))|| 
bin(F(l, l),f oU(A))\\bin(F(l, 2), / o/ 4 (A))|| . . . \\bin(F(n, n), f of 4 (A)) 
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Let us define the following problem: 
Problem 5: 

Instance: A positive integer n, two binary strings x and y 

two matrices V, W e N nx " x " 
Query: Find two matrices A, B e {0, i} rix " x " 
such that: 

A ± B 

g 2 {A .* V) = g 2 {B . * V) = x 
g 2 (A .* W)=g 2 (B . * W) - y 

Let us characterize the complexity of Problem^. 

Proposition 1 Problem 5 is NP-Complete. 

Proof Idea of Proposition [1} 

We want to show how to transform a solution of 3DCT to a solution of Problem 
5 . Without loss of generality, we work in dimension 2. Let us suppose that we 
want to find a matrix A £ {0, l} 3x3 such that: 

3 

y £A(i,j)=R(i) (la) 
i=i 

Y,A(i,j) = C(j) (lb) 
i=i 

where R = (3,2, 1) and C = (2,3, 1). 

It is easy to see that the determination of the matrix A £ {0, l} 3x3 which verifies 
Equations (flj is also equivalent to determining the matrix B S {0,l} 6x6 such 
that: 



Y,B(iJ)=Rd(i) (2a) 

6 

Y,B{i,j)=Cd(j) (2b) 



i=l 

where Rd = (3, 2, 1, 3, 2, 1) and Cd = (2, 3, 1, 2, 3, 1). 

Remark 1: Rd ( respectively Cd ) is a duplication of R ( respectively C ). 
It is easy to see that from the matrix: 

111 
.1=1 1 1 
1 
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which verifies Equations ([T]), we can associate the two following matrices B2 

1 1 \ 

1 

1 

111 

110 

1 / 

1 1 1 \ 
110 

1 
110 

1 
1 / 

which verify Equations ([2]). This is the idea of the transformation which as- 
sociates to one solution of the problem defined in Equations ((T|) two distinct 
solutions of the problem defined in Equations ([2]). 

Before the proof, let us introduce the function duplic (which is pseudo-duplication 
) of x. We note: 

x = x{l)x{2)...x{p) (3) 

where x(i) G {0, 1} and p = 3 x n? x \log2(n + 1)] . We define the function t as 
follows: 

t(i, n) — i x n x \log 2 (n + 1)1 ; < i < 3n. (4) 
The function duplic is defined as follows: 

duplic(x, n) =dcopy(x, 1, n)\\dcopy(x, 2,n)\ \ . . . \ \dcopy(x, n,n)\\ 
dcopy(x, 1, n)\\dcopy(x, 2, n)\ | . . . \ \dcopy(x, n,n)\\ 
dcopy(x, Ti+l, n)\\dcopy(x, n + 2, 7i)|| . . . | \dcopy(x, 2n, 7i)|| 
dcopy(x, Ti+l, n)\\dcopy(x, n + 2, 7i)|| . . . | \dcopy(x, 2n, 7i)|| 
dcopy(x, In + 1, n)\ \dcopy(x, 2n + 2, n)\ \ . . . \ \dcopy(x, in, n)\\ 
dcopy(x, 2n + 1, n)\ \dcopy(x, 2n + 2, n)\ | . . . | \dcopy(x, 3n, n) 

where dcopy(x,i,n) is defined as follows: 

dcopy{x,i,n) = strcopy(x,i,n)\\strcopy(x,i,n) 

and 



£ 2 = 



Bs = 



.4 

3 X3 



3 x3 

A 



3 x3 



A 

3X3 







1 
1 

V 



strcopy(x, i, n) = x(l + t(i — 1, n))x(2 + t(i — 1, n)) . . . x(t(i, n)) 



10 



For illustration, duplic(x, 3) is denned as follows: 



duplic(x, 3) =x(l) . 

x(l). 
x(19) 
x{19) 
x{37) 
x(37) 



x(6)x(l) . . . x(6)x(7) . . . x(12)x(7) . . . z(12)a;(13) . . . a;(18)a;(13) . . . x(18)|| 
x(6)x(l) . . . x(6)x(7) . . . x(12)x(7) . . . x(12)x(13) . . . x(18)x(13) . . . x(18)|| 
, . x(24)x(19) . . . x(24)x(25) . . . x(30)x(25) . . . x(30)x(31) . . . x(36)x(31) . . . x(36) 
, . x(24)x(19) . . . x(24)x(25) . . . x(30)x(25) . . . x(30)x(31) . . . x(36)x(31) . . . x(36) 
, . x(42)x(37) . . . x(42)x(43) . . . x(48)x(43) . . . x(48)x(49) . . . x(54)x(49) . . . cc(54) 
, . x(42)a;(37) . . . x(42)a;(43) . . . a;(48)a;(43) . . . x(48)x(49) . . . x(54)a;(49) . . . a;(54) 



Remark 2: In the definition of strcopy(x, i, n), the term x(l+t(i— 1, n))x(2+ 
t[i — 1,ti)) . . . x(t(i,n)) means the concatenation of all the elements between 
x(l + t(i — l,n)) and x(t(i,n)). In other words: x(l + t(i — l,n))x(2 + t(i — 
1, n) . . . x(t(i, n)) = x(l+t(i— 1, n))x(2+t(i— 1, n) . . . x(j) . . . x{— l+t(i, n))x(t(i, n)) 
where 1 + t{i — 1, n) < j < t(i, n). 

Proof of Proposition [T] : It suffices to show that 3DCT Problem 5. 

Let us suppose that the procedure Generalize solves Problem 5 and we want 
to show how to build a procedure SolSDCT which solves 3DCT. 
The procedure SolSDCT takes as input a binary string x, an integer n and 
returns as output the matrix A of size n such that g%{A) — x. The procedure 
Generalize takes as input: 

• p the dimension of the matrices 

• two binary strings x and y 

• two matrices V and W 
and returns as output: 

• two matrices C and D such that: 

• g 2 {C . * V) = g 2 {D .* V) = x and g 2 {C .* W) = g 2 (D . * W) = y 

We show in the procedure below how to use Generalize as a subroutine to solve 
SolSDCT. 

Procedure Sol3DCT( n : integer , x : string , var A : matrix ) ; 

V, W , C , D : matrix 
p , i , j , k : integer 
z : string 
begin 

1: V < — MOnes{2n) 

2: W < — Mones(2n) 

3: zi — duplic(x,n) 

4: p i — 2 x n 

5: Generalize(p, z, z,V,W,C, D) 

6: For i = 1 to n do 
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7: For j = 1 to n do 

8: For k = 1 to n do 

9: A(i,j, k) <— C(i,j, k) + C(i,j + n, k) 

10: Endfor 
11: Endfor 
12: Endfor 
end 

Remark 3: In the procedure Sol3DCT, the matrix A belongs to the set 
{0, l}«x™ x », whereas the matrices C,D belong to the set {0, I}2«x2«x2n 

The string z of the procedure Sol3DCT (see instruction 3) is constructed 
such that g2{A) = X if and only if the matrices C and D defined in Equations 



(0 and (|6]) are the solutions of Problem 5 with the following entries: 

• 2n the dimension of the matrices, 

• two binary strings z and z, 

• two matrices V and W such that V = Mones(2n) , W = Mones(2n). 
The terms of the matrix C are: 



The 





'C(i,j,k) = A(i,j,k), 


if 


1 


< 


< 


n 






C(i,j+n,k) = 0, 


if 


1 


< 


i,3,k < 


n 






C{i + n,j,k) = 0, 


if 


1 


< 


i,j,k < 


n 




< 


C{i + n,j + n,k) = A(i,j,k), 


if 


1 


< 


i,j,k < 


n 






C(i,j,k + n) = 0, 


if 


1 


< 


i,3,k < 


n 






C(i,j + n,k + n) = A(i,j,k), 


if 


1 


< 


hj,k < 


n 






C(i + n,j,k + n) = A(i,j,k), 


if 


1 


< 


hj,k < 


n 






C(i + n, j + n, k + n) = 0, 


if 


1 


< 


hj,k < 


n 




rms of the matrix D are: 














'D(i,j,k)=0, 




if 


1 


< i,j,k 


< 


n 


D(i,j + n,k) = A(i,j,k), 




if 


1 


< hj,k 


< 


n 


D(i + n,j,k) = A(i,j,k), 




if 


1 


< iJ,k 


< 


n 


D(i + n,j + n, k) = 0, 




if 


1 


< 


< 


n 


D(i,j,k + n) = A(i,j,k), 




if 


1 


< iJ,k 


< 


n 


D(i,j + n,k + n) = 0, 




if 


1 


< hj,k 


< 


n 


D{i + n, j, k + n) = 0, 




if 


1 


< h3,k 


< 


n 


D(i + n,j + n,k + n) = A(i,j, k), 


if 


1 


< hj,k 


< 


n 



(5) 



(6) 



The main idea of the design of the Collision-resistant hash function H3 is 
that: 
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• the hash function H3 is the composition of two functions Hi and H2, 

• the function H± is a function for which Problem 1, Problem 2 and Problem 
3 can't be solved efficiently and Hi is not a compression function. 

• H 2 is a hash function such as SHA-256, RIPEMD, or HAVAL, .... 

Notation 1 Let us consider two vectors V\ and Vi. We say that Vi is not a 
linear combination of Vz and we note Vi is NLC of V2 if and only if /3 a £ K 
such that V\ = aVi . 

Two matrices F,G € N" xnxn verify the hypotheses ([7]) if and only if : 

Fj* G (7a) 
Vi, j such that 1 < i,j < n, the vector F(i,j, *) is NLC of the vector G(i, j, *) 

' (7b) 

Vj, k such that 1 < j, k < n, the vector F(*, j, k) is NLC of the vector G(*, j, k) 

(7c) 

Vi, k such that 1 < i,k < n, the vector F(i, *,k) is NLC of the vector G(i, *,k) 

(7d) 

Vi, j such that 1 < i,j < n, the vector F(i,j, *) is NLC of the vector VOnes(n) 

(7e) 

yj, k such that 1 < j, k < n, the vector F(*,j,k) is NLC of the vector VOnes(n) 

(7f) 

Vi, k such that 1 < i, k < n, the vector F(i, *, k) is NLC of the vector VOnes(n) 

(7g) 

Vi, j such that 1 < i,j < n, the vector G(i, j, *) is NLC of the vector VOnes(n) 

(7h) 

Vj, k such that 1 < j, k < n, the vector G(*, j, k) is NLC of the vector VOnes(n) 

(7i) 

Vi, k such that 1 < i, k < n, the vector G(i, *, k) is NLC of the vector VOnes(n) 

(7j) 

The matrices V and W used as entries in the procedures Hi and H3 below 
verify the hypotheses defined by Equations (O . We note e the empty chain. Let 
us define the function VectMat which takes as input a vector Vect of size n 3 
and returns as output an equivalent matrix A of size n x n x n. 

Procedure VectMat (Vect : Table[l..n 3 ] of bit ; Var A : Table[l..n, l..n, 
l..n] of bit ) 

Var i, j, k , t : integer 
Begin 
t <r- 1 

For i = 1 to n do 

For j = 1 to n do 
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For k = 1 to n do 

A(i,j,k) <- Vect(t) 

endfor 
endfor 
endfor 
End 



The function Hi is defined as follows: 



Function H\ : 

Entry. Mq the initial message 

V : Table[l..n, l..n,l..n] of integer 

W : Table[l..n, l..n,l..n] of integer 
n: an integer 
Output. M 2 : an intermediate message 
Var i, p : integer 
Begin 

1. Pad Mq with one bit equal to 1, followed by a variable number of 

zero bits and a block of bits encoding the length of Mq in bits, 
so that the total length of the padded message is the smallest 
possible multiple of n 3 . Let Mi denote the padded message 

2. Cut Mi into a sequence of n 3 -bits vectors 

B\ , B2, ■ . . , Bi , . . . B p 

3. M 2 <- e 

4. For i = 1 to p do 

4.1 VectMat(B,,A) 

4.2 M 2 «- M 2 || g 2 (A. * V) || g 2 (A. * W) 
Endfor 

5. return M 2 
End 



Our hash function H3 is defined as the composition of the function H± and 
#2, where H 2 is a hash function such as SHA-256, RIPEMD, HAVAL... The 
matrices V and W used as entry in the hash function H3 must verify the hy- 
potheses defined in Equations ([7]). To obtain the hash of the message Mq by 
H 3 , we proceed as follows: 

• we obtain the intermediate message M 2 by application of the function Hi 
to the message Mq, 

• by application of the hash function H 2 to M 2 , we build the hash of the 
initial message. 

Formally, the hash function is defined as follows: 



Procedure H3 
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Entry. Mq the initial message 

V : Table[l..n, l..n,l..n] of integer 
W : Table[l..n, l..n,l..n] of integer 
n : an integer 

Output. Result : the hash of the message M 

Begin 

M 2 <- Fi(M ,V,W,n) 
Result <- H 2 (M 2 ) 

End 
Comment : 



We can represent roughly the function H\ as follows: 
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A 




In the Figure [TJ 

• the aim of the branches (1) and (2) is to make that the Problem 2 and 
Problem 3 are difficult to solve efficiently for the function H 3 

• the aim of the branch (6) is to make sure that Problem 1 is difficult to 
solve efficiently for the function H 3 

During some attacks, an adversary is needed to solve the following problem: 
Problem 6: 

Instance: Matrices A, V, W 
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Binary strings : g 2 (A . * V) and g 2 (A .* W) 
Query: Find a matrix B such that A ^ B and: 

g 2 (A.* V) = g 2 (B .* V") 

.92^4 . * W) = 5 2 (S . * W) 

Based on Problem 5, we deduce that Problem 6 is NP-Complete. 

Second Preimage attack and Collision of the function H3 are difficult be- 
cause: 

• Problem 5 and Problem 6 are NP-Complete, 

• From the fact that V and W verify the hypotheses ©, we deduce that if 
we take two matrices A and B such that A ^ B, then we would probably 
have g 2 {A . * V)\\g 2 (A . * W) ^ g 2 {B . * V)\\g 2 {B . * W). 

First Preimage attack of the function H3 is difficult because the 3DCT is NP- 
Complete. Truncated differential attack of Hi is possible, but the differential 
attack of H3 is difficult because 3DCT is NP-Complete and also Problem 5 is 
NP-Complete. 

4 Numerical Simulation 

Let's consider the two messages xl and x2 : 

xl =dl31cM)2c5e6eec4693cZ9a0698a//95c 
2/ca658712467ea&4004583e68/67/89 
55ad340609/4&30283e488832571415a 
085125e8/7cdc99/d91d&ci/280373c56 
d8823e3156348/5&ae6dacd436c919c6 
dd53e2&487da03/d02396306d248cda0 
e99/33420/577ee8ce54667080a80dle 
c698216c66a8839396/965266//72a70 

x2 =dl31dd02c5e6eec4693d9a0698a//95c 
2/ca650712467ea64004583e68/67/89 
55ad340609/4630283e4888325/1415a 
085125e8/7cdc99/d91d6d7280373c56 
d8823e3156348/56ae6dacrf436c919c6 
cid53e23487da03/<i02396306ci248cdaO 
e99/33420/577ee8ce54667080280dle 
c698216c66a8839396/965a66//72a70 
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We have MD5(xl)=MD5(x2)= EFE502F744768114B58C8523184841F3 
after applying our hash function on these messages using n = 8, V[z][j][fc] = 
i + 8j + 64k, W[i][j][k] = 700 - (j + 8 * k + 64 * i) for 1 < i < n we obtain: 
H 3 (xl)= 5fe0e56f9a4ab66a47d73ce660a2c4eb and 
H 3 (x2) = 620e2f3cfe0afc403c0a8343173526fc. 
It follows that MD5(xl) = MD5(x2) whereas H 3 (xl) + H 3 (x2). 

5 Conclusion 

From a classical hash function H 2 , we have built a new hash function H 3 from 
which First Preimage attack, Second Preimage attack and Collision attack are 
difficult to solve. Our new hash function is a composition of functions. The 
construction used the NP-completeness of Three-dimensional contingency ta- 
bles and the relaxation of the constraint that a hash function should also be a 
compression function. The complexity of our new hash function increases with 
regard to the complexity of classical hash functions. 
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